RHEL 9 Hardened US DoD DISA STIG High

CAT I, CAT II and CAT III rules, applied at build time

DISA groups STIG findings by severity: CAT I findings are the most severe, CAT II are medium and CAT III are low. This image covers CAT I, CAT II and CAT III rules.

The image applies the STIG settings for Red Hat Enterprise Linux 9 when it is built, using the cloud provider's published STIG automation for this OS where one exists (on AWS, the EC2 STIG bundle). Each build logs the checksum of the hardening content and runs a verification step; a build that fails verification is marked failed (install status failed_verification).

• Built on Red Hat Enterprise Linux 9.
• STIG High settings for accounts, authentication, audit, file permissions, services and kernel parameters, as defined in the bundle for this OS.
• Audit and time-sync services installed and running where the system supports them.
• A login message that points to the hardening status file and log, and a JSON report recording the STIG level, install status and audit and time-sync service status.

What a STIG is

The Defense Information Systems Agency (DISA), a combat support agency of the US Department of Defense (DoD), publishes Security Technical Implementation Guides (STIGs) on cyber.mil. A STIG is a configuration standard for one product, such as an operating system: each rule names a setting, explains why it matters, and gives a check and a fix.

STIG requirements are derived from the NIST SP 800-53 security controls through DISA Security Requirements Guides (SRGs). DoD Instruction 8500.01 directs DoD components to apply STIGs and SRGs to the systems they operate, and many civilian agencies, contractors and regulated businesses use them as a hardening baseline.

DISA releases updated STIGs on a regular schedule. Each STIG ships with SCAP content so that automated scanners can check a system against it, and the DISA STIG Viewer shows every rule with its check and fix text.

CAT I, CAT II and CAT III

Every STIG rule carries a severity category code. DISA defines them as follows:

• CAT I (High): Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.
• CAT II (Medium): Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.
• CAT III (Low): Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

A High profile applies rules of every category; Medium applies CAT II and CAT III; Low applies CAT III only. Choose the lowest profile that meets your authorization requirements, since every added rule can restrict how the system is used.